# Sign-in policy

> Control which email domains can sign in to your Unifuse institution and whether a first-time sign-in may be linked to an existing account by email.

Source: https://docs.unifuse.ai/administration/sign-in-policy/

The sign-in policy decides who at your institution may complete single sign-on, beyond what
the identity provider itself allows.

## Before you start

- You need the *manage institution* permission.
- Open **Administration → Sign-in policy**.

## Allowed email domains

Your institution's own domain is always allowed. **Additional allowed email domains** takes a
comma-separated list of extra domains, up to 50. Subdomains are not implied: list
`law.example.edu` as well as `example.edu` if both should sign in. The read-only
**Sign-in is allowed from** list shows the result.

A user whose email domain is not allowed is refused at sign-in even if the identity provider
accepts them.

## Link existing accounts by email

**Link existing accounts by email** is off by default. It matters when someone signs in for
the first time from an identity that Unifuse has not seen, but whose email address already
belongs to a Unifuse account (for example an account created earlier through SCIM, or after
the institution changed identity providers).

- **Off**: the sign-in is refused, so an identity cannot take over an existing account by
  sharing its email address.
- **On**: the identity is linked to the existing account and the link is recorded in the
  audit log.

Turn it on during an identity-provider migration, then turn it off again.

## Notes

- Changes apply from the next sign-in.
- OIDC sign-ins require the identity provider to report the email address as verified.